Last updated May 23, 2024
PRIVACY POLICY
1. OUR PRIVACY POLICY
Toca Boca AB, reg. no. 556870-3721, having its registered office at Box 90293, 120 24 Stockholm, Sweden (“Toca Boca”, “We”, “Our” or “Us”) is committed to protecting Your privacy as a data subject (“You” or “Your”) and the secure processing of Your personal data and We strive to limit the processing of personal data as far as possible and do not collect personal data beyond what is necessary.
Needless to say, all processing of personal data, including the collection, registration, storing and general handling is governed by applicable privacy legislation, including the General Data Protection Regulation (“GDPR”). Toca Boca strives to make sure that the processing of personal data done by Toca Boca, is done in accordance with applicable legislation.
As a company based in the European Union, We apply the GDPR to everyone but if You reside outside the European Union and use Our services, We may apply additional standards to You as required by local law. To the extent that the California Consumer Privacy Act (“CCPA”) applies to You, the definitions in this privacy policy are to be read as follows: “personal data” includes “personal information”; “data subject” includes “consumer”; “controller” includes “business”; “processor” includes “service provider”, all as defined under the CCPA. For more information about the CCPA, please see Section 11.
As a service directed towards children, We also adhere to the Children’s Online Privacy Protection Rule (“COPPA”). To the extent that the COPPA applies to You, the definitions in this privacy policy are to be read as follows: “personal data” includes “personally identifiable information”; “processor” includes “service provider”, all as defined under the COPPA.
1.1 Who are We?
Toca Boca is an award-winning play studio that creates digital toys and everyday products for kids and a part of a group of gaming studios, Spin Master Digital, that are all owned by Our parent company Spin Master Ltd. We cooperate with Spin Master Ltd, and the other gaming studios of the group (each a “Group Company”) to learn from one another, help each other and improve how We all make apps.
Our contact details are:
Toca Boca AB
Attn: Privacy Officer
Box 90293
120 31 Stockholm, Sweden
The contact details to Our Data Protection Officer are:
Spin Master Ltd
Attn: Data Protection Officer
225 King Street West
Toronto, ON M5V 3M2, Canada
Should You have any questions related to privacy and/or Your rights, You can also contact Us at [email protected] or Our Data Protection Officer at [email protected]. Below You will also find detailed information on how We process Your personal data, on Your rights and how You can exercise them.
1.3 Our Services
Our website is just for grownups, while Our apps and Our more child friendly webpages are designed for the whole family, including children. We encourage parents and guardians to take active part in your children's gaming experiences. Our social media accounts are intended and made for anyone over the age of 13 (or any other age applicable in your country).
We take privacy seriously at Toca Boca and this policy is designed to share what information We collect and how We use it. When You visit Our website, install one of Our apps or interact with Our social media channels, Toca Boca processes Your personal data in accordance with this privacy policy and acts as the controller of Your personal data as defined by the GDPR.
1.4 When does this privacy policy apply?
This privacy policy describes how We collect and use Your personal data when You are using Our services, playing Our apps or interacting with Us. It applies to all visitors of this website, end users (including paying and non-paying users, grownups and children) and Our social media channels.
2. YOUR RIGHTS AS A DATA SUBJECT
Under the GDPR You have certain rights concerning Our processing of Your personal data. If You would like to access, correct, erase or limit the use or disclosure of any of Your personal data that has been collected and stored by Toca Boca or exercise any other right under applicable data protection legislation, please notify Us at [email protected] so that We may consider and respond to Your request in accordance with applicable law.
Right of information: You have the right to be provided information concerning Our processing of Your personal data. This includes understanding the purposes of processing, the categories of personal data concerned, and who else might receive Your personal data.
Right of access: You have the right to obtain confirmation as to whether or not We are processing Your personal data and, if this should be the case, have access to Your personal data.
Right to rectification: You have the right to obtain rectification of inaccurate or incomplete personal data concerning You.
Right to erasure (“right to be forgotten”): Under certain circumstances, such as if the personal data is no longer necessary for the original purpose, if You withdraw Your consent, or if the personal data has been unlawfully processed, You have the right to obtain the erasure of Your personal data. However, this does not apply if Our interest in continuing to process Your personal data outweighs Your interest in having it deleted or if We are subject to a legal requirement to retain Your personal data.
Right to restriction: Under certain circumstances, such as if You contest the accuracy of Your personal data or if the processing is unlawful but You oppose erasure and request restriction instead, You have the right to obtain the restriction of processing.
Right to data portability: Under certain circumstances, such as when the processing is based on Your consent or a contract with You and the processing is carried out by automated means, You have the right to receive Your personal data in a structured, commonly used and machine-readable format and the right to transmit this information to another controller.
Right to object: Under certain circumstances You have the right to object to the processing of Your personal data. This includes but is not limited to the right to object in cases in which We process Your personal data based on legitimate interest (Article 6(1)(f) GDPR).
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, Swedish Authority for Privacy Protection, if You consider that Toca Boca’s processing of Your personal data infringes the GDPR. You can also lodge a complaint with Your own national data protection authority, please see list here.
Right to withdraw consent: If a processing of Your personal data is based on Your consent as set out in this privacy policy, You have the right to withdraw Your consent at any time.
Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning You or similarly significantly affects You.
3. TYPES OF PERSONAL DATA WE COLLECT
In this Section, We describe the types of personal data that We collect or create. In Section 4 We describe for what purposes and which legal ground that We rely upon when We process Your personal data. For the purposes of this privacy policy, the term personal data shall have the same definition as it has under the GDPR.
User Information: Information about Your use of Toca Boca’s apps - such as in-app generated events based on Your interaction with the app, error and crash reports.
Device Information: Information from Your device - such as device IDs, Android ID, IDFV, operating system, platform, screen resolution and similar information about Your device and device settings/usage, IP address (including Your approximate location).
Unique Identifiers: Information from Your account - such as account ID, Toca profile ID, email address and password (where email login is applicable).
Purchasing Data: Information relating to Your purchase history - such as in-app properties/playset and purchasing tendencies.
Social Media: Information about You and Your interactions with Toca Boca fan pages on social media - such as name and/or user name, posts You like and comment.
Customer Information: Information from You provided to Us via Our customer support and/or service functions - such as first name, last name, email, age, Your issues and/or ideas.
4. WHAT PERSONAL DATA ARE USED FOR WHAT PURPOSE AND WITH WHICH LEGAL BASIS?
In the table below We indicate:
- what We use Your personal data for;
- Our legal justifications (each called a “legal basis”) under the GDPR for each purpose; and
- the categories of personal data We use for each purpose.
Here is a general explanation of each legal basis to help You understand the table:
- Contract with You: Where it is necessary for Toca Boca to process Your personal data to:
- fulfill obligations under a contract with You. This includes Toca Boca’s obligations under the Terms of Service to provide the apps service to You.
- verify information before the start of a new contract with You.
- Legitimate interest: Where Toca Boca has an interest in using Your personal data in a particular way, which is necessary and justified after considering any risks to You and other Toca Boca’s users. For example, We may use Your usage data to improve the Toca Life World service for all users. Contact Us if You want to understand a specific legitimate interest and retain information on the balancing test.
- Consent: When Toca Boca asks You to actively consent to Toca Boca use of Your personal data for a specific purpose.
4.1 TOCA BOCA WORLD - We collect the following information from You when You install and/or use the app Toca Boca World on platforms such as Apple AppStore, Google Play Store, Amazon, Samsung etc.
|
What We use Your personal data for and why |
Legal basis allowing the purpose | Categories of personal data and where they come from |
|
To provide the Toca Boca service in accordance with Our contract with You. For example, give You access to Our app. | Contract with You. |
|
| In Toca Life World We sell expansions (playsets) in the in-app shop. We are doing this to provide You as a player a more fun and unique experience in Our app. | Contract with You. |
|
| To be able to understand how many active players, how the player experience currently is and the engagement of the app. This includes information of your user engagement, number of active users, purchasing behaviour, technical performance of the app. This information will help Us to understand how the app will perform from a business perspective. We may also use this data to test out new features and ideas. |
It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in being able to understand how many active users, user experience and user engagement that we have and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
| To be able to provide functionality and improvements of Our app, We need to collect, store and analyze crash related information from Your device. This will help Us to understand what could be wrong in the app. | Contract with You. |
|
| We use user attribution and marketing analytics to measure the effectiveness of Our advertising. For the purpose of marketing campaigns to measure ad performance by driven installs and click through rates on various media platforms. This will help Us to bring new players to the app. |
It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in knowing our players to be able to create better experiences for You. We have also determined that this processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. For the purposes of analyzing marketing campaigns, no personal data is shared with any third party networks. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
4.2 TOCA BOCA DAYS - We collect the following information from You when You install and/or use the app Toca Boca Days on platforms such as Apple AppStore, Google Play Store etc.
| What We use Your personal data for and why | Legal basis allowing the purpose | Categories of personal data used for the purpose |
|
To provide the Toca Boca service in accordance with Our contract with You. For example, give You access to Our app. | Contract with You. |
|
| To allow You to connect with friends, save Your progress and to make purchases in the app. |
It is necessary for the purpose of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in being able to connect You with Your friends should You want to, and that the processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
| To be able to provide a self-service for You to delete Your account. | Legal Obligation (Article 17 GDPR). |
|
| To be able to provide You with Our virtual currency. | Contract with You. |
|
| Whenever an action is performed in-app that requires a server side response, We will be processing and storing pieces of personal data as part of log files. We do this to ensure technical functionality. | Contract with You. |
|
| To be able to provide functionality and improvements of Our app, We need to collect, store and analyze crash related information from Your device. This will help Us to understand what could be wrong in the app. |
Contract with You. |
|
| To be able to understand how many active players, how the player experience currently is and the engagement of the app. This includes information of your user engagement, number of active users, purchasing behaviour, technical performance of the app. This information will help Us to understand how the app will perform from a business perspective. We may also use this data to test out new features and ideas. |
It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in knowing our players to be able to create better experiences for You. We have also determined that this processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
|
In order to provide You with support/assistance/help in Our app, We need to ask You certain questions in order to help You. We do this to provide You with a better gaming experience if something unexpected happens in Our app. We also ask for Your feedback and suggestions to offer You an even better customer experience and better products. We are using chatbots and machine learning features in some instances of this processing. |
Depending on the purpose of Your question We rely on either one of the legal grounds below: Contract with You. or It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in knowing our players to be able to create better experiences for You. We have also determined that this processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
4.3 OTHER APPS - We collect the following information from You when You install and/or use the other apps on platforms such as Apple AppStore, Google Play Store, Amazon, Samsung etc. Please note that for Toca Kitchen 2 and Toca Hair Salon 4 this only applies to the apps available on Amazon
| What We use Your personal data for and why | Legal basis allowing the purpose | Categories of personal data used for the purpose |
|
To provide the Toca Boca service in accordance with Our contract with You. For example, give You access to Toca Life World/Our app. |
Contract with You. | Unique Identifiers |
| As part of Our app We sell expansions (playsets) in the in-app shop. | Contract with You. |
|
|
Process players’ in-app activity in order to answer questions relating to the performance of Our app and Our business. To understand how many active users, user experience and user engagement. |
It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in knowing our players to be able to create better experiences for You. We have also determined that this processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
| When We have a crash in Our app (e.g in the phone You have in Your hand) We collect, store and analyze information about that crash. | Contract with You. |
|
| For the purpose of marketing campaigns to measure ad performance by driven installs and click through rates on various media platforms. |
It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in being able to understand how our ads are received, that the processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
| Whenever an action is performed in-app that requires a server side response We will be processing and storing pieces of personal data as part of log files. |
Contract with You. |
|
4.4 SOCIAL MEDIA - We collect the following information from You when You interact with Us on Our social media pages such as Facebook, TikTok, Instagram etc.
| What We use Your personal data for and why |
Legal basis allowing the purpose |
Categories of personal data used for the purpose |
|
We reply to comments left by fans on Our own posts, We define this as reactive engagement. We also engage (by liking, leaving emojis or commenting) with fan channels on an as needed basis, We define this as proactive engagement. These are posts that have either gained high traction among the Toca Boca community or have created content that We like to support. We also share social media posts internally, but these are also publicly accessible on all social media platforms. |
It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in being able to connect with You on social media, that the processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
When processing Your Personal Data from our social media accounts when you engage in our fan pages We are considered a Joint Controller as defined by the GDPR with the social media platform.
4.5 WEBSITES
We don’t collect any Information from You when You are visiting Our website for children
We collect the following Information from You when You are visiting Our website for Grownups
| What We use Your personal data for and why |
Legal basis allowing the purpose | Categories of personal data used for the purpose |
| To ensure network and information security of Our website. |
It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in being able to offer you a secure website experience, that the processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
| Our website incorporates YouTube videos. This integration is subject to the YouTube terms of service, and may result in the collection of Your personal data by Google according to the Google privacy policy. |
It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in being able to perform the personal data processing, that the processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
|
If You are using Our customer support services powered by Helpshift so that We can provide service in accordance with Our contract with You. For example, give You access to Our app or answer any questions that You may have. |
Depending on the purpose of Your question We rely on either one of the legal grounds below: Contract with You. or It is necessary for the purposes of Our legitimate interests. When balancing interests, Toca Boca has determined that We have a legitimate interest in being able to understand how You feel about Our products, that the processing is necessary to achieve that purpose, and that Our interest outweighs Your right not to have Your personal data processed for this purpose. You may contact Us for more information about how the determination was made. Please see Our contact details in Section 1. |
|
Please note that Our websites may contain links to websites of other companies. If You follow a link to any of these websites, You should be aware that they have their own privacy practices and that We do not assume any liability for their processing of Your personal data. Therefore, please make sure to read their privacy policy
5. HOW LONG DO WE KEEP THE PERSONAL DATA?
We will retain Your personal data for as long as necessary to provide Our services to You or as required by law.
We will keep Your personal data that is tied to Your account and Your usage of Our apps as long as You use the services and for a period of two years after You last used the service unless You contact Us asking for a removal.
For analytics, instead of deleting Your personal data We may anonymise the personal data so that no direct or indirect identifiers remain and after such anonymisation We will store the information for an indefinite period.
For marketing attribution purposes, We keep Your personal data for three months after that We delete it.
For the purpose of customer support and services We will keep Your personal data for one year before We delete it.
6. COMMUNITY OR SOCIAL MEDIA FEATURES AND HOW WE KEEP THEM SECURE
Our website and services may include community or social media features, such as forums and chat rooms. Please note that any information You post in these features may be publicly available. We encourage You to use caution when sharing personal data in these features. We take reasonable measures to keep these features secure and protect Your personal data.
7. WITH WHOM DO WE SHARE YOUR INFORMATION?
Toca Boca may share Your information, including Your personal data which includes but is not limited to billing information or user names, with Our agents, contractors, or service providers who are hired to perform services on Our behalf. We may also share Your information with Our affiliates. We disclose necessary information to authorities such as the Swedish Authority for Privacy Protection and other authorities if We are required to do so by law, or under some circumstances if You have requested Us to do so.
7.1 Categories of recipients with whom We share with, regardless of app
7.1.1 Suppliers and subcontractors
Description of the recipient: Suppliers and subcontractors are companies that only have the right to process the personal data they receive from Us on behalf of Toca Boca, i.e. data processors. Examples of such suppliers and subcontractors are software and data storage providers, and business consultants.
Service Providers - Processors
- We use the following service providers that acts as processors in relation to children in all Our apps:
- We use Google Crashlytics, Firebase and BigQuery for bug reporting, crash reporting and analytics.
- We use Amazon Web Services for hosting Our apps.
- We use Helpshift for customer service and to host Our FAQs. In the event We are contacted through Our helpdesk by a child, We will reply once before immediately deleting the child’s email address and any associated personal data.
- We also work with AppsFlyer as an attribution provider to help Us understand Your interactions with the apps and to optimize and analyze mobile ad campaigns. AppsFlyer does not collect any personally identifiable information about You.
- We use Data Dog to monitor Our technical environments. This helps Us to keep Our services running and if something unexpected happens.
- Apart from the above mentioned service providers We also use the following service providers in relation to children in Our Toca Days app:
- We use PlayFab for backend services and analytics. PlayFab collects geolocation at a country level.
- We use BackTrace for monitoring crashes and crash reports.
The service providers listed collect and process the information described in tables 4.1, 4.2, and 4.3 as applicable. We have implemented these providers with custom settings to ensure that personal data collected is used solely for the purposes outlined and is not disclosed to any other third parties.
If You have any questions about the collection and processing of Your personal data, please contact using the contact details provided in Section 1.1.
7.1.2 Spin Master Group
Description of the recipient: Group Companies. These Group Companies only have the right to process the personal data they receive from Us on behalf of Toca Boca, i.e. data processors.
List of companies that We share personal data with:
Spin Master Ltd.
225 King Street West
Toronto, ON M5V 3M2, Canada
Please see the privacy policy here.
Spin Master Toys UK Limited
Winter Hill House Marlow Reach,
Station Approach, Marlow, England, SL7 1NT
Please see the privacy policy here.
Sago Sago Toys Inc
John St., 5th Floor,
Toronto, ON M5T 1X3, Canada
Please see the privacy policy here.
Purpose and legal basis: This is required for Toca Boca to be able to provide You with its services and functionalities. We have a legitimate interest in being able to access and provide these services and functionalities (Article 6(1)(f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that Our interest outweighs Your right not to have Your information processed for this purpose. You are entitled to object to this processing, for reasons connected to the circumstances in Your particular case. Please see Section 2 for more information about Your rights.
8. THIRD COUNTRY TRANSFERS
In some cases Toca Boca might transfer personal data outside the EU and EEA, so-called third countries. For Our transfers to the US, Canada and UK following conditions apply:
- Adequacy Decision. This means that We transfer personal data to countries outside of the EEA which have adequate laws to protect personal data, as determined by the European Commission. For example, We transfer the personal data described in Section 4 to service providers and partners based in Canada and UK.
- Standard Contractual Clauses (“SCCs”). These clauses require the other party to protect Your data and to provide You with EU-level rights and protections. For example, We use SCCs to transfer the personal data described in Section 4 to Our service providers and partners which use servers in the US. For transfers to the US We also rely on the EU-US Data Privacy Framework.
- Exceptions in special situations apply, such as to fulfill a contract with You or Your consent to the specific transfer.
We also identify and use additional protections as needed for each data transfer. For example, We use technical protection measures, such as encryption and pseudonymization.
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
We are committed to protecting Our users’ personal data and are among other things using pseudonymization, encryption and user based access levels to protect Your personal data. We strive to take appropriate technical and organizational measures to ensure the protection of Your personal data. That said, We cannot and do not guarantee and do not accept liability for unintentional disclosure.
10. NOTICE TO CALIFORNIA RESIDENCE
Under California Civil Code sections 1798.83, “Shine the Light Act”, California residents are entitled to ask Us for a notice describing what categories of personal data We share with third parties or corporate affiliates for those third parties or corporate affiliates’ direct marketing purposes. Please note that We do not share Your personal data with any third parties or affiliates for their direct marketing purposes.
CCPA provides consumers who are California residents with specific rights regarding their personal data.
Right to Access: If You are a California resident, You have the right to request, up to two times each year, access to categories and specific pieces of Your personal data that We collect, use and/or disclose.
Right to Delete: If You are a California resident, You have the right to request that We delete Your personal data that We collect, subject to applicable legal exceptions.
Right to Opt Out of Sale of Personal Information: As the term is defined by the CCPA, Toca Boca does not sell any personal data.
To make a request regarding Your rights under CCPA as described above, please send an email to [email protected] or [email protected] or write to us, using the addresses above.
11. CHANGES TO THIS PRIVACY POLICY
This privacy notice may be changed from time to time to accommodate new technologies, industry practices, regulatory requirements or for other purposes. We will provide notice to You if these changes are material and, where required by applicable law, We will obtain Your consent. The notice may be sent to You by email to the last email address You provided Us with, by posting notice of such changes on Our sites and applications, or by other means, consistent with applicable law prior to making the change. The date of the last modification is stated at the top of this document.
12. CHILDREN’S PRIVACY POLICY
If you are a child check out our privacy policy here https://tocaboca.com/kids/docs/privacy-policy
If you are a parent and you would like to review or have your child’s data deleted, please contact us at [email protected]
13. KIDS PRIVACY ASSURED BY PRIVO: COPPA SAFE HARBOR CERTIFICATION
Toca Boca is a member of the PRIVO Kids Privacy Assured COPPA Safe Harbor Certification Program (“the Program”). The Program certification applies to the digital properties listed on the validation page that is viewable by clicking on the PRIVO Seal. PRIVO is an independent, third-party organization committed to safeguarding children’s personal data collected online. The PRIVO COPPA certification Seal posted on this page indicates that Toca Boca has established COPPA compliant privacy practices and has agreed to submit to PRIVO’s oversight and consumer dispute resolution process. If You have questions or concerns about Our privacy practices, please contact Us at 1-800-819-0199 or [email protected]. If You have further concerns after You have contacted us, You can contact PRIVO directly at [email protected].
